@oniroproject/core 0.6.1 → 0.6.2

package/dist/index.cjs

@@ -49,6 +49,7 @@ __export(index_exports, {
   defaultContext: () => defaultContext,
   defaultPaths: () => defaultPaths,
   detectProjectSdkVersion: () => detectProjectSdkVersion,
+  detectSigningConfigNames: () => detectSigningConfigNames,
   downloadAndInstallSdk: () => downloadAndInstallSdk,
   downloadFile: () => downloadFile,
   encryptPwd: () => encryptPwd,
@@ -87,6 +88,7 @@ __export(index_exports, {
   noopLogger: () => noopLogger,
   noopProgress: () => noopProgress,
   parseHilogLine: () => parseHilogLine,
+  pickSigningKind: () => pickSigningKind,
   readJson5File: () => readJson5File,
   readJsonFile: () => readJsonFile,
   removeCmdTools: () => removeCmdTools,
@@ -929,25 +931,101 @@ var fs10 = __toESM(require("fs"), 1);
 var path10 = __toESM(require("path"), 1);
 var import_node_child_process2 = require("child_process");
 var import_json52 = __toESM(require("json5"), 1);
+
+// src/sign/applicationCert.ts
+var OPEN_HARMONY_APPLICATION_CERT = `-----BEGIN CERTIFICATE-----
+MIICRDCCAcmgAwIBAgIED+E4izAMBggqhkjOPQQDAwUAMGgxCzAJBgNVBAYTAkNO
+MRQwEgYDVQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVh
+bTEoMCYGA1UEAxMfT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gUm9vdCBDQTAeFw0y
+MTAyMDIxMjE0MThaFw00OTEyMzExMjE0MThaMGgxCzAJBgNVBAYTAkNOMRQwEgYD
+VQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVhbTEoMCYG
+A1UEAxMfT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gUm9vdCBDQTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABE023XmRaw2DnO8NSsb+KG/uY0FtS3u5LQucdr3qWVnRW5ui
+QIL6ttNZBEeLTUeYcJZCpayg9Llf+1SmDA7dY4iP2EcRo4UN3rilovtfFfsmH4ty
+3SApHVFzWUl+NwdH8KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwHQYDVR0OBBYEFBc6EKGrGXzlAE+s0Zgnsphadw7NMAwGCCqGSM49BAMDBQAD
+ZwAwZAIwd1p3JzHN93eoPped1li0j64npgqNzwy4OrkehYAqNXpcpaEcLZ7UxW8E
+I2lZJ3SbAjAkqySHb12sIwdSFKSN9KCMMEo/eUT5dUXlcKR2nZz0MJdxT5F51qcX
+1CumzkcYhgU=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICYTCCAeWgAwIBAgIEHmXAPTAMBggqhkjOPQQDAwUAMGgxCzAJBgNVBAYTAkNO
+MRQwEgYDVQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVh
+bTEoMCYGA1UEAxMfT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gUm9vdCBDQTAeFw0y
+MTAyMDIxMjE1MzJaFw00OTEyMzExMjE1MzJaMGMxCzAJBgNVBAYTAkNOMRQwEgYD
+VQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVhbTEjMCEG
+A1UEAxMaT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gQ0EwdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQhnu7Hna8XNa2KyqRf5+lBJScE4xqf89N0g0OuqAb2re8nGsvWkw26
+uDekfnBYicd+G3Cydqa2zFIwV7Talyg2ULW3r8KbGpyl84mJEPPRmCGJ+H9gtCsf
++OrJ4Y76LVWjYzBhMB8GA1UdIwQYMBaAFBc6EKGrGXzlAE+s0Zgnsphadw7NMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTbhrciFtUL
+oUu33SV7ufEFfaItRzAMBggqhkjOPQQDAwUAA2gAMGUCMG3cXjiDmXTvf7D4Omhf
+qcc2nuO+EMfWE+N9ZhBP5UhV34mAGWi3SfLU6rcV0urWEQIxAMYIb3epOnKhUrcm
+Lfu1WKzFlpYQwmw73RaCHP2I3k6NcuWOYeNwWXSNZ8o0nzvaLg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICMzCCAbegAwIBAgIEaOC/zDAMBggqhkjOPQQDAwUAMGMxCzAJBgNVBAYTAkNO
+MRQwEgYDVQQKEwtPcGVuSGFybW9ueTEZMBcGA1UECxMQT3Blbkhhcm1vbnkgVGVh
+bTEjMCEGA1UEAxMaT3Blbkhhcm1vbnkgQXBwbGljYXRpb24gQ0EwHhcNMjEwMjAy
+MTIxOTMxWhcNNDkxMjMxMTIxOTMxWjBoMQswCQYDVQQGEwJDTjEUMBIGA1UEChML
+T3Blbkhhcm1vbnkxGTAXBgNVBAsTEE9wZW5IYXJtb255IFRlYW0xKDAmBgNVBAMT
+H09wZW5IYXJtb255IEFwcGxpY2F0aW9uIFJlbGVhc2UwWTATBgcqhkjOPQIBBggq
+hkjOPQMBBwNCAATbYOCQQpW5fdkYHN45v0X3AHax12jPBdEDosFRIZ1eXmxOYzSG
+JwMfsHhUU90E8lI0TXYZnNmgM1sovubeQqATo1IwUDAfBgNVHSMEGDAWgBTbhrci
+FtULoUu33SV7ufEFfaItRzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFPtxruhl
+cRBQsJdwcZqLu9oNUVgaMAwGCCqGSM49BAMDBQADaAAwZQIxAJta0PQ2p4DIu/ps
+LMdLCDgQ5UH1l0B4PGhBlMgdi2zf8nk9spazEQI/0XNwpft8QAIwHSuA2WelVi/o
+zAlF08DnbJrOOtOnQq5wHOPlDYB4OtUzOYJk9scotrEnJxJzGsh/
+-----END CERTIFICATE-----
+`;
+
+// src/sign/generateSigningConfigs.ts
 var APL_VALUES = ["normal", "system_basic", "system_core"];
 var APP_FEATURE_VALUES = ["hos_normal_app", "hos_system_app"];
-function copyFilesToProject(projectDir, paths, logger) {
+function pickSigningKind(apl) {
+  return apl === "normal" ? "profile-release" : "application-release";
+}
+var SIGNING_KIND_CONFIG = {
+  "profile-release": {
+    hapKeyAlias: "openharmony application profile release",
+    certBasename: "OpenHarmonyProfileRelease.pem"
+  },
+  "application-release": {
+    hapKeyAlias: "OpenHarmony Application Release",
+    certBasename: "OpenHarmonyApplication.cer"
+  }
+};
+function copyFilesToProject(projectDir, paths, kind, logger) {
   logger.info("[sign] Copying signing material into project...");
   const signaturesDir = path10.join(projectDir, "signatures");
   fs10.mkdirSync(signaturesDir, { recursive: true });
   fs10.copyFileSync(paths.keystore, path10.join(signaturesDir, "OpenHarmony.p12"));
   fs10.copyFileSync(paths.profileCert, path10.join(signaturesDir, "OpenHarmonyProfileRelease.pem"));
   fs10.copyFileSync(paths.unsignedProfileTemplate, path10.join(signaturesDir, "UnsgnedReleasedProfileTemplate.json"));
+  if (kind === "application-release") {
+    fs10.writeFileSync(
+      path10.join(signaturesDir, "OpenHarmonyApplication.cer"),
+      OPEN_HARMONY_APPLICATION_CERT
+    );
+  }
 }
 function resolveAppFeature(apl, override) {
   if (override) return override;
   return apl === "normal" ? "hos_normal_app" : "hos_system_app";
 }
-function modifyProfileTemplate(projectDir, apl, appFeature, logger) {
-  logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature})...`);
+function extractLeafCertificate(chainPath) {
+  const certContent = fs10.readFileSync(chainPath, "utf-8");
+  const parts = certContent.split("-----END CERTIFICATE-----");
+  if (parts.length < 3) {
+    throw new OniroError(`${chainPath} does not contain enough certificates.`);
+  }
+  return parts[2].trim() + "\n-----END CERTIFICATE-----\n";
+}
+function modifyProfileTemplate(projectDir, apl, appFeature, logger, options = {}) {
+  const kind = options.kind ?? pickSigningKind(apl);
+  logger.info(`[sign] Modifying profile template (apl=${apl}, app-feature=${appFeature}, kind=${kind})...`);
   const appJsonPath = path10.join(projectDir, "AppScope/app.json5");
   const profileTemplatePath = path10.join(projectDir, "signatures/UnsgnedReleasedProfileTemplate.json");
-  const profileCertFilePath = path10.join(projectDir, "signatures/OpenHarmonyProfileRelease.pem");
   if (!fs10.existsSync(appJsonPath)) {
     throw new OniroError(`${appJsonPath} does not exist.`);
   }
@@ -972,13 +1050,16 @@ function modifyProfileTemplate(projectDir, apl, appFeature, logger) {
   profileTemplate["bundle-info"]["bundle-name"] = appJson.app.bundleName;
   profileTemplate["bundle-info"]["apl"] = apl;
   profileTemplate["bundle-info"]["app-feature"] = appFeature;
-  const certContent = fs10.readFileSync(profileCertFilePath, "utf-8");
-  const certs = certContent.split("-----END CERTIFICATE-----");
-  if (certs.length < 3) {
-    throw new OniroError(`${profileCertFilePath} does not contain enough certificates.`);
+  const distCertChainPath = path10.join(
+    projectDir,
+    "signatures",
+    SIGNING_KIND_CONFIG[kind].certBasename
+  );
+  profileTemplate["bundle-info"]["distribution-certificate"] = extractLeafCertificate(distCertChainPath);
+  if (options.acls !== void 0) {
+    profileTemplate.acls = profileTemplate.acls ?? {};
+    profileTemplate.acls["allowed-acls"] = options.acls;
   }
-  const thirdCert = certs[2].trim() + "\n-----END CERTIFICATE-----\n";
-  profileTemplate["bundle-info"]["distribution-certificate"] = thirdCert;
   fs10.writeFileSync(profileTemplatePath, JSON.stringify(profileTemplate, null, 2));
 }
 function generateP7bFile(projectDir, paths, logger) {
@@ -1018,7 +1099,27 @@ function generateP7bFile(projectDir, paths, logger) {
     );
   }
 }
-function updateBuildProfile(projectDir, logger) {
+function detectSigningConfigNames(projectDir) {
+  const buildProfilePath = path10.join(projectDir, "build-profile.json5");
+  if (!fs10.existsSync(buildProfilePath)) return ["default"];
+  let parsed;
+  try {
+    parsed = import_json52.default.parse(fs10.readFileSync(buildProfilePath, "utf-8"));
+  } catch {
+    return ["default"];
+  }
+  const products = parsed.app?.products;
+  if (!Array.isArray(products) || products.length === 0) return ["default"];
+  const names = [];
+  for (const product of products) {
+    const name = product.signingConfig;
+    if (typeof name === "string" && name.length > 0 && !names.includes(name)) {
+      names.push(name);
+    }
+  }
+  return names.length > 0 ? names : ["default"];
+}
+function updateBuildProfile(projectDir, kind, logger) {
   logger.info("[sign] Writing signing configs into build-profile.json5...");
   const materialDir = path10.join(projectDir, "signatures", "material");
   const buildProfilePath = path10.join(projectDir, "build-profile.json5");
@@ -1032,21 +1133,22 @@ function updateBuildProfile(projectDir, logger) {
       throw new OniroError(`Error parsing ${buildProfilePath}: ${e.message}`, e);
     }
   }
+  const { hapKeyAlias, certBasename } = SIGNING_KIND_CONFIG[kind];
+  const configNames = detectSigningConfigNames(projectDir);
+  logger.info(`[sign] Writing signingConfigs entries: ${configNames.join(", ")}`);
   buildProfile.app = buildProfile.app ?? {};
-  buildProfile.app.signingConfigs = [
-    {
-      name: "default",
-      material: {
-        certpath: "./signatures/OpenHarmonyProfileRelease.pem",
-        storePassword: encryptedStorePassword,
-        keyAlias: "openharmony application profile release",
-        keyPassword: encryptedKeyPassword,
-        profile: "./signatures/app1-profile.p7b",
-        signAlg: "SHA256withECDSA",
-        storeFile: "./signatures/OpenHarmony.p12"
-      }
+  buildProfile.app.signingConfigs = configNames.map((name) => ({
+    name,
+    material: {
+      certpath: `./signatures/${certBasename}`,
+      storePassword: encryptedStorePassword,
+      keyAlias: hapKeyAlias,
+      keyPassword: encryptedKeyPassword,
+      profile: "./signatures/app1-profile.p7b",
+      signAlg: "SHA256withECDSA",
+      storeFile: "./signatures/OpenHarmony.p12"
     }
-  ];
+  }));
   fs10.writeFileSync(buildProfilePath, JSON.stringify(buildProfile, null, 2));
 }
 function prepareMaterialDirectory(projectDir, logger) {
@@ -1086,12 +1188,13 @@ function generateSigningConfigs(options) {
     profileCert: path10.join(sdkPath, "toolchains/lib/OpenHarmonyProfileRelease.pem"),
     unsignedProfileTemplate: path10.join(sdkPath, "toolchains/lib/UnsgnedReleasedProfileTemplate.json")
   };
+  const kind = pickSigningKind(apl);
   logger.info("[sign] Starting signing configuration generation...");
-  copyFilesToProject(projectDir, paths, logger);
-  modifyProfileTemplate(projectDir, apl, appFeature, logger);
+  copyFilesToProject(projectDir, paths, kind, logger);
+  modifyProfileTemplate(projectDir, apl, appFeature, logger, { kind, acls: options.acls });
   generateP7bFile(projectDir, paths, logger);
   prepareMaterialDirectory(projectDir, logger);
-  updateBuildProfile(projectDir, logger);
+  updateBuildProfile(projectDir, kind, logger);
   logger.info("[sign] Signing configuration generated successfully.");
 }
 
@@ -1777,7 +1880,7 @@ async function createScaffold(opts) {
 }
 
 // src/index.ts
-var VERSION = "0.6.1";
+var VERSION = "0.6.2";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ALL_SDKS,
@@ -1799,6 +1902,7 @@ var VERSION = "0.6.1";
   defaultContext,
   defaultPaths,
   detectProjectSdkVersion,
+  detectSigningConfigNames,
   downloadAndInstallSdk,
   downloadFile,
   encryptPwd,
@@ -1837,6 +1941,7 @@ var VERSION = "0.6.1";
   noopLogger,
   noopProgress,
   parseHilogLine,
+  pickSigningKind,
   readJson5File,
   readJsonFile,
   removeCmdTools,